Closed rivernews closed 1 year ago
Same reason in https://github.com/rivernews/media-literacy/issues/38, we won't implement success rate. But we can symbolically read from map result just to get the stories count, which is going to equal the stories input length anyway. But it could be a POC of accessing map outputs.
Also to better support rolling deploy, we should pin lambda version in Sfn: https://dev.to/aws-builders/aws-step-functions-are-active-executions-affected-when-your-state-machine-gets-updated-5dfn
Seems to cause Sfn execution error:
1 validation error detected: Value 'arn:aws:lambda:us-west-2:***:function:media-literacy-dev-story-lambda/28' at 'functionName' failed to satisfy constraint: Member must satisfy regular expression pattern: (arn:(aws[a-zA-Z-]*)?:lambda:)?([a-z]{2}((-gov)|(-iso(b?)))?-[a-z]+-\d{1}:)?(\d{12}:)?(function:)?([a-zA-Z0-9-_\.]+)(:(\$LATEST|[a-zA-Z0-9-_]+))? (Service: AWSLambda; Status Code: 400; Error Code: ValidationException; Request ID: 93150322-fa71-4c0b-a653-25232e48685a; Proxy: null)
Is version number already included in lambda_function_arn
? Possibly, looking at AWS doc. Watch the FunctionArn
already includes version number at the end.
"Resource": "arn:aws:lambda:us-west-2:***:function:media-literacy-dev-story-lambda"
We may need to look at the TF AWS Lambda module doc.lambda_function_qualified_arn
, now the Sfn def shows "Resource": "arn:aws:lambda:us-west-2:**:function:media-literacy-dev-story-lambda:29"
... \User: arn:aws:sts::368061806057:assumed-role/media-literacy-dev-batch-stories-sfn/XhCRchTWFeYYluPMRgpIuucObgkkFsVB is not authorized to perform: lambda:InvokeFunction on resource: arn:aws:lambda:us-west-2:368061806057:function:media-literacy-dev-story-lambda:29 because no identity-based policy allows the lambda:InvokeFunction action (Service: AWSLambda; Status Code: 403; Error Code: AccessDeniedException; Request ID: b0f196af-b186-4769-8862-9acbf4fc5afb; Proxy: null)
...:function:myFunction:*"
. By doing this, we enforce Sfn should always use versioned lambda - we deny unqualified arn which means deny if not specifying version.Confirmed Sfn is executing ok now.
We still need to confirm Sfn finalizer shows the total stories count. This will take some time, up to 13*3 minutes.
Confirmed!
https://github.com/rivernews/media-literacy/pull/37/commits/ef44117b8a6d9cd9b445466182b09a4d2f0ca0da
https://github.com/rivernews/media-literacy/pull/37/commits/b5d71d331f290823b631a1b8d2a50dd5c56ff0ad